Synology SSL VPN Client vulnerabilities

5 CVEs affecting Synology SSL VPN Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-47961, published 2026-04-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-13283, published 2019-04-01. High severity, CVSS 7.4. EPSS: 1.4% chance of exploitation in the next 30 days. Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command,…
CVE-2018-8929, published 2018-07-06. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle…
CVE-2021-47961, published 2026-04-10. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead…
CVE-2023-5748, published 2023-11-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service…
CVE-2021-47960, published 2026-04-10. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local…